Read the docs

TP-Link

Records637All Threatist records
Exploited (KEV)6In CISA KEV
CVSS critical100CVSS 9.0–10.0
CVSS high356CVSS 7.0–8.9

Exploited now

TP-Link records in CISA KEV
TI-2023-27456 TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability Priority CRITICAL 86KEV 2025-09-03TI-2025-08589 TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability Priority CRITICAL 96KEV 2025-09-03TI-2020-14907 TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability Priority CRITICAL 97KEV 2025-09-02TI-2023-16571 TP-Link Multiple Routers Command Injection Vulnerability Priority CRITICAL 97KEV 2025-06-16TI-2023-01313 TP-Link Archer AX-21 Command Injection Vulnerability Priority CRITICAL 97KEV 2023-05-01TI-2015-02672 TP-Link Multiple Archer Devices Directory Traversal Vulnerability Priority CRITICAL 90KEV 2022-03-25

Components

Products in the NVD configurations · select one to filter the records
Tl-wr841n Firmware 39 records CRITICAL Tl-wr886n Firmware 39 records MEDIUM Er5110g Firmware 25 records LOW Er5120g Firmware 25 records LOW Er5510g Firmware 25 records LOW Er5520g Firmware 25 records LOW R4149g Firmware 25 records LOW R4239g Firmware 25 records LOW

Records

8 records in Omada Eap610 Firmware · all components

TI-2025-14256 CVE-2025-15628 · GHSA-8mhg-76f5-54fp

Hardcoded Certificates in TP-Link Omada Device Communications

Priority LOW 36

Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed devices.

CVSS 4.0HIGH 8.2 Adjacent network No auth User interaction EPSS 0.0032 Published 2026-08-03 No fix listed CWE-798
TI-2025-14257 CVE-2025-15629 · GHSA-5wj2-44xm-2hrq

Weak Session Key Generation in TP-Link Omada Adoption Protocol

Priority LOW 30

A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllers and managed devices may be predictable due to insufficient entropy in sessio…

CVSS 4.0MEDIUM 6.9 Adjacent network No auth User interaction EPSS 0.00333 Published 2026-08-03 No fix listed CWE-331
TI-2025-14258 CVE-2025-15630 · GHSA-xmx9-537g-pr66

Device Provisioning Race Condition in TP-Link Omada Adoption Workflow

Priority LOW 26

A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimate device completes registration, resulting in provisioning in…

CVSS 4.0MEDIUM 5.8 Network Low privileges User interaction EPSS 0.00312 Published 2026-08-03 No fix listed CWE-362
TI-2025-14259 CVE-2025-15631 · GHSA-gq9r-pf66-hjcm

Weak Credential Storage in TP-Link Omada Devices

Priority LOW 25

A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection.

CVSS 4.0MEDIUM 5.7 Adjacent network High privileges No interaction EPSS 0.00301 Published 2026-08-03 No fix listed CWE-759
Open these records in search →